Decomposition of network flows with applications to cluster analysis of Internet access traffic

We analyze Internet user traffic flows measured at the access network of a Portuguese ISP. Using singular-value decomposition, the weekly traffic utilization of each user is decomposed in periodic, noise and burst components. The most important component is the periodic, which is responsible for 52% of the total variability of the data set. This component was used to obtain groups of users with similar weekly profiles of traffic utilization, without loosing the main structure of the clusters formed with the complete data set, which includes all three components. Moreover, the analysis on the periodic component revealed types of weekly profiles not detected by the cluster analysis based on the complete data set